CVE-2026-19072: Velociraptor Privilege Escalation Flaw

CVE-2026-19072 Overview

CVE-2026-19072 is a privilege escalation vulnerability in Velociraptor, an open-source digital forensics and incident response (DFIR) platform. The flaw exists in how Velociraptor handles the internal compiled_collector_args field used by hunt objects to cache compiled Velociraptor Query Language (VQL) statements. The server exposes this internal field through a user-facing API call, allowing any authenticated user with the investigator role to inject arbitrary compiled VQL into a hunt. Because the pre-compiled VQL bypasses Access Control List (ACL) checks that are normally applied during artifact compilation, an attacker can execute VQL as an administrator on the Velociraptor server.

Critical Impact
An authenticated low-privilege investigator can escalate to full administrative control of the Velociraptor server and execute arbitrary VQL across managed endpoints.

Affected Products

Velociraptor DFIR server (hunt scheduling subsystem)
Deployments where users are assigned the investigator role or higher
See the Velociraptor Advisory CVE-2026-19072 for affected version ranges

Discovery Timeline

2026-09-24 - CVE-2026-19072 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-19072

Vulnerability Analysis

Velociraptor organizes large-scale endpoint collection through hunts, which deploy VQL artifacts to many endpoints simultaneously. To avoid recompiling artifacts for every endpoint, the server compiles VQL once and stores the resulting instructions inside the hunt object under the compiled_collector_args field. This field is intended to be populated only by the server after ACL validation of the requesting user.

The vulnerability stems from Velociraptor accepting user-supplied values for this internal field when a hunt is scheduled through the API. An investigator can submit a crafted hunt definition that includes arbitrary pre-compiled VQL in compiled_collector_args. The server dispatches those statements without re-evaluating permissions, treating the payload as if it had been compiled under administrative context. This is categorized under [CWE-164] Improper Handling of Trailing Special Element, reflecting an input-validation failure on a field that should be server-controlled.

Root Cause

The root cause is a missing server-side input filter on hunt creation requests. The API deserializes the entire hunt object, including fields that should be internal, and trusts the attacker-controlled compiled_collector_args payload instead of recompiling the artifact from source under the requesting user's ACL.

Attack Vector

Exploitation requires network access to the Velociraptor API and valid credentials with at least the investigator role. The attacker constructs a hunt request where compiled_collector_args contains VQL that would normally require administrator privileges, such as execution of shell commands on the server or access to privileged artifacts. When the hunt dispatches, the embedded VQL runs with the privileges of the server process rather than the submitting user, resulting in arbitrary VQL execution as an administrator.

No verified public proof-of-concept code is available. Refer to the Velociraptor Advisory CVE-2026-19072 for vendor-provided technical details.

Detection Methods for CVE-2026-19072

Indicators of Compromise

Hunt objects created by non-administrator accounts that contain populated compiled_collector_args fields inconsistent with the source artifact
Audit log entries showing VQL execution with administrator-equivalent capabilities tied to users holding only the investigator role
Unexpected server-side command execution, file access, or artifact invocations originating from hunt dispatch events

Detection Strategies

Review the Velociraptor audit log for hunt creation events and correlate the submitting user's role against the privileges required by the hunt's compiled VQL
Compare the stored compiled_collector_args of each hunt against a fresh server-side recompilation of the referenced artifacts; mismatches indicate tampering
Alert on API calls to hunt creation endpoints where the request body includes the compiled_collector_args key

Monitoring Recommendations

Forward Velociraptor server audit logs and API access logs to a centralized logging platform for retention and correlation
Monitor for role assignment changes that grant investigator or higher privileges to accounts
Baseline normal hunt-creation behavior per user and alert on deviations in volume, scope, or privileged artifact usage

How to Mitigate CVE-2026-19072

Immediate Actions Required

Upgrade Velociraptor to the patched version identified in the Velociraptor Advisory CVE-2026-19072
Audit all accounts holding the investigator role or higher and remove unnecessary privileges
Review existing hunts for unauthorized compiled_collector_args content and delete or quarantine suspicious entries

Patch Information

Velociraptor has published a security advisory with fixed version information. Apply the vendor-supplied update as documented in the Velociraptor Advisory CVE-2026-19072. The patch enforces server-side control of the compiled_collector_args field so user-supplied values are discarded.

Workarounds

Restrict API access to the Velociraptor server to trusted administrative networks until patching is complete
Temporarily revoke the investigator role from accounts that do not require hunt-scheduling capability
Enable detailed audit logging and actively review new hunt submissions for anomalous compiled payloads

bash

# Verify installed Velociraptor server version against the fixed release
velociraptor version

# Review current users and their assigned roles
velociraptor --config server.config.yaml user show --all